9aa1813ecb73c793189c5869d6597cccb2d3e6b3e7f678db16fd2bb91d03a6cc | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0e8e7fe06419a857b5efff6b88af4899_JaffaCakes118.dll
Size

3KB
MD5

0e8e7fe06419a857b5efff6b88af4899
SHA1

d592e8cf65717ecd3a76de2f0ec2e8a395513b3b
SHA256

9aa1813ecb73c793189c5869d6597cccb2d3e6b3e7f678db16fd2bb91d03a6cc
SHA512

01e127b0a3824625a16024738f6616ca7036975fd1a1b30c436c88e355db00f4ddce2c6acfc56659335b0e8588911646fedcba2c29ccd84111c05e68b9a1f7e7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2592	836	rundll32.exe	28
PID 836 wrote to memory of 2592	836	rundll32.exe	28
PID 836 wrote to memory of 2592	836	rundll32.exe	28
PID 836 wrote to memory of 2592	836	rundll32.exe	28
PID 836 wrote to memory of 2592	836	rundll32.exe	28
PID 836 wrote to memory of 2592	836	rundll32.exe	28
PID 836 wrote to memory of 2592	836	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e8e7fe06419a857b5efff6b88af4899_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e8e7fe06419a857b5efff6b88af4899_JaffaCakes118.dll,#1
  2⤵
  PID:2592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads